Malicious PDF — malware analysis report

Static analysis result for SHA-256 a3c3a3576a0ecf99…

MALICIOUS

PDF

95.4 KB Created: 2021-08-25 05:55:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-22
MD5: f100bd57f405d3ca9412063d5f804de1 SHA-1: 5bbe3df7ce842723908835053fef8310f740a8c3 SHA-256: a3c3a3576a0ecf9935c70bf4f08d13f4b97486faeb334456827329bfdfa04052
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file is identified as malicious by ClamAV and an ML classifier. It functions as a link farm, with numerous URLs pointing to websites, several of which are hosted on compromised WordPress installations. The presence of multiple distinct hosts and the use of 'utm_term' parameters suggest an attempt to lure users to potentially malicious content, likely for phishing or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://davebakeragency.com/wp-content/plugins/super-forms/uploads/php/files/ac9a7ba8f055bf27f4546b5e6ce8bb40/kadovemugufupokilejanew.pdf In PDF document text
    • https://onecre.com/images/content/files/rutelisezek.pdfIn PDF document text
    • https://canadianrelocation.net/wp-content/plugins/formcraft/file-upload/server/content/files/16090c8e7a43ac---fokude.pdfIn PDF document text
    • http://baraanduliaptti.org/userfiles/file/72372690068.pdfIn PDF document text
    • https://atlasautoglass.com/wp-content/plugins/formcraft/file-upload/server/content/files/160fef6be3be7a---gibazuvovufefopen.pdfIn PDF document text
    • https://noriupapildu.lt/ckfinder/userfiles/files/37926478942.pdfIn PDF document text
    • https://cffcommunications.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/16094b99f11b06---lemesesojiwolo.pdfIn PDF document text
    • https://unique.global/wp-content/plugins/super-forms/uploads/php/files/16c61904239fa7fc9de609eb972f927f/nugadasozome.pdfIn PDF document text
    • http://www.ellisrasbetonwerke.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1607a0eb56a124---61698135210.pdfIn PDF document text
    • https://mercedesmazo.es/wp-content/plugins/formcraft/file-upload/server/content/files/160a62c7583382---79490236311.pdfIn PDF document text
    • http://patokapugsnkisses.com/clients/61143/File/fivowasigumalanomukagiviv.pdfIn PDF document text
    • http://terralis.eu/catalogue_dynamique/file/25663859355.pdfIn PDF document text
    • https://californiaoptionsrealestate.com/wp-content/plugins/super-forms/uploads/php/files/34b86141928bb241801b4e85d0936bc1/fozasomuti.pdfIn PDF document text
    • http://appletechsolutions.com/userfiles/file/pakobofosijabetakuguk.pdfIn PDF document text
    • https://grouptm2.com/contents//files/40275743662.pdfIn PDF document text
    • http://jshtextile.com/UserFiles/file///rarabekotagakorozufotu.pdfIn PDF document text
    • http://koyomisushi.com/uploads/files/xakexamosi.pdfIn PDF document text
    • http://akinmedikal.com/uploads/file/39228689459.pdfIn PDF document text
    • https://alarrabnews.com/images/content/content/file/84736260052.pdfIn PDF document text
    • https://cwlighting.com/wp-content/plugins/super-forms/uploads/php/files/76d9b25d6e512cec1a9fb4c61fbb59f8/51421910112.pdfIn PDF document text
    • http://rhodeislandalpha.com/clients/56223/File/47069533984.pdfIn PDF document text
    • https://theshairpodcast.com/wp-content/plugins/super-forms/uploads/php/files/6b2a10c0202b734328d0b117fb3bca79/15253570532.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1KS0DP0cxss/uplcv?utm_term=complications+of+cholecystitisPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001112e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1112E 17152 bytes
SHA-256: 8ab68c5fc676075c82c071becfd7f3452b83c04d3f216cc47cadbca1e0b0d558
font_01_sfnt_off00013e2a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13E2A 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00015641.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15641 10788 bytes
SHA-256: 7ed06a26845458aa1239949dbea1b42b8da3a32b9cb936d34413008deedf4bab

Open this report in the interactive analyzer, or submit your own file for analysis.